Preventing cross site request forgery

To prevent cross site request forgery attacks, all cloud operations API calls require that the IBM-CSRF-Token token is set in the HTTP header of every request.

Note: This feature does not apply to IBM® Operational Decision Manager on Cloud.

Your operations application must obtain the CSRF token by calling the

POST
/instance/services/csrf_token

REST API with a JSON body that is similar to the following example:

{
  "requested_lifetime": 7200
}

The requested_lifetime property defines the number of seconds the token is valid for. If you don't specify a value, the default value of 7200 seconds is used, which is the maximum permitted value. You must always send a payload with the call, even if it is empty. The token is returned as a string in the csrf_token property of the response object.

If a call contains an expired token, it fails with HTTP response code 403 and the error CWMGG0015E: The request was blocked because the IBM-CSRF-TOKEN token header is not valid in the response. To retrieve a new token, your operations application must call the POST /instance/services/csrf_token operation again. The application can then use the new token to resubmit the failed request.